Numerous studies have proven that abnormal behaviors related to business and transactions can be detected from user logs. In actual use, we discover that user logs are often formatted in complex ways, and there are challenges to analyzing them: (1) errors in log parsing that necessitate significant human intervention to resolve accurately, and (2) insufficient information mining. These two issues often result in increased human investment and reduced accuracy. To address these challenges, we propose DeepUserLog, a framework for anomaly detection of user logs containing a large number of key-value pairs. Our approach sidesteps the necessity of cumbersome preprocessing and a log parsing step that risks introducing noise. DeepUserLog retrieves the key-value pairs within the log and extracts the semantic features of the content after removing the values in key-value pairs, representing them as semantic vectors. In addition, the framework categorizes key-value pairs into four types while leveraging and identifying the temporal keys to uncover deeper connections between logs. Furthermore, it conducts a more thorough analysis of the information associated with numeric and text-based key-value pairs. DeepUserLog has been validated on real-world user log datasets from industry and public system log datasets, yielding promising results confirming its efficacy.

In automatic control networks, for man-in-the-middle attacks, they tamper with the control instructions and the underlying feedback data, but the protocol and format of the data packet, making the attack difficult to detect. In this paper, we introduce a network intrusion detection model based on the automatic control network behavior understanding and machine learning. The model can understand the operating status of the control network from the correlation of parameter status, find abnormal behavior status that does not conform to the normal operating status, and locate and trace the source of the tampered instruction or parameter to understand the attacker's intention. We verified the feasibility and practicability of the model in simulating real automatic control network scenarios.

Model-based fault diagnosis, using statistical hypothesis testing, residual generation (by analytical redundancy), and parameter estimation, has been an active area of research for the past four decades. However, these techniques are developed in isolation, and generally, a single technique cannot address the diagnostic problems in complex systems. In this paper, we investigate a hybrid approach, which combines model-based and data-driven techniques to obtain better diagnostic performance than the use of a single technique alone, and demonstrate it on an antilock braking system. In this approach, we first combine the parity equations and a nonlinear observer to generate the residuals. Statistical tests, particularly the generalized likelihood ratio tests, are used to detect and isolate a subset of faults that are easier to detect. Support vector machines are used for fault isolation of less-sensitive parametric faults. Finally, subset selection (via fault detection and isolation) is used to accurately estimate fault severity.

Conventional maintenance strategies, such as corrective and preventive maintenance, are not adequate to fulfill the needs of expensive and high availability transportation and industrial systems. A new strategy based on forecasting system degradation through a prognostic process is required. The recent advances in model-based design technology have realized significant time savings in product development cycle. These advances facilitate the integration of model-based diagnosis and prognosis of systems, leading to condition-based maintenance and increased availability of systems. With an accurate simulation model of a system, diagnostics and prognostics can be synthesized concurrently with system design. In this paper, we develop an integrated prognostic process based on data collected from model-based simulations under nominal and degraded conditions. Prognostic models are constructed based on different random load conditions (modes). An interacting multiple model (IMM) is used to track the hidden damage. Remaining-life prediction is performed by mixing mode-based life predictions via time-averaged mode probabilities. The solution has the potential to be applicable to a variety of systems, ranging from automobiles to aerospace systems.

Chillers constitute a significant portion of energy consumption equipment in heating, ventilating and air-conditioning (HVAC) systems. The growing complexity of building systems has become a major challenge for field technicians to troubleshoot the problems manually; this calls for automated ldquosmart-service systemsrdquo for performing fault detection and diagnosis (FDD). The focus of this paper is to develop a generic FDD scheme for centrifugal chillers and also to develop a nominal data-driven (ldquoblack-boxrdquo) model of the chiller that can predict the system response under new loading conditions. In this vein, support vector machines, principal component analysis, and partial least squares are the candidate fault classification techniques in our approach. We present a genetic algorithm-based approach to select a sensor suite for maximum diagnosabilty and also evaluated the performance of selected classification procedures with the optimized sensor suite. The responses of these selected sensors are predicted under new loading conditions using the nominal model developed via the black-box modeling approach. We used the benchmark data on a 90-t real centrifugal chiller test equipment, provided by the American Society of Heating, Refrigerating and Air-Conditioning Engineers, to demonstrate and validate our proposed diagnostic procedure. The database consists of data from sixty four monitored variables of the chiller under 27 different modes of operation during nominal and eight faulty conditions with different severities.

Networked embedded systems, such as modern automobiles, consist of a large number of physically distributed nodes (subsystems). Each node communicates with other nodes via a network. With the rapid growth in the number of control units, a global diagnosis method, which collects the diagnostic information from all the subsystem controllers, is not practical because of high communication requirements and time delays induced by centralized diagnosis. This paper presents a distributed diagnosis algorithm based on a digraph model and a local fault-test dependency matrix (D-matrix) at each node. Each local diagnoser first performs local diagnosis, taking into account local sensed information only. Then, the local diagnoses are transparently updated to a global diagnosis through communication among nodes, constrained by the topology of interconnected digraph models. The distributed diagnosis algorithm is evaluated on several real-world examples.

The paper presents a new diagnostic development platform for automotive systems. The development platform consists of a target ECU rapid prototyping system and a hardware-in-the-loop simulation (HILS) equipment. An integrated diagnostic process that seamlessly employs a graph-based dependency model and quantitative models for intelligent diagnosis is introduced, along with a practical example of model-based engine diagnosis. The diagnostic strategy is tested and validated using the HILS platform.

A system wide prognostic process is required to fulfill the needs of expensive and high availability industrial systems. The recent advances in model-based design technology have facilitated the integration of model-based diagnosis and prognosis of systems, leading to condition-based maintenance. In this paper an integrated prognostic process based on data collected from model-based simulations under nominal and degraded conditions is described. Interacting Multiple Model (IMM) is used to track the hidden damage. Remaining life prediction is performed by mixing mode-based life predictions via time-averaged mode probabilities. The prognostic process is demonstrated on a suspension system.